Upstream Security protects connected vehicles, smart machines and the wider Physical AI ecosystem from cyber attacks and quality failures. Its customers are vehicle makers, suppliers, fleet operators and mobility companies.
These organisations run millions of connected assets, and a problem on one vehicle or component can repeat across a whole fleet. Upstream gives them one place to see how those assets behave and to act on threats and defects before they spread.
At A Glance
| Vendor | Upstream Security |
|---|---|
| Category | Automotive, smart mobility and Physical AI cybersecurity (XDR) |
| Deployment | Customer cloud or SaaS |
| Agentic AI | Ocean AI agents, AI agent monitoring, MCP server |
| Customers | Cisco, Volvo, CNH Industrial |
| Certifications | ISO 27001, TISAX |
| Scale | Over 40 million assets and smart machines monitored |
| Market classification | Workforce IAM |
What Upstream Security Does
Connected vehicles, components, IoT devices, APIs and AI agents create cyber risk and quality problems at a scale no team can review by hand. Upstream’s approach is to collect the data these assets already produce and model how each one normally behaves, so detection can work at the level of a single asset, a component across many vehicles, or a whole fleet.
The same behavioural picture serves security teams hunting attacks and engineering teams chasing defects, and it supports compliance work under NIS2, UNECE WP.29 R155 and the Cyber Resilience Act.
Products
Cyber XDR
Cyber XDR is the detection and response product for connected assets. It discovers the attack surface, including AI agents, API endpoints and smart devices, and finds shadow or rogue assets nobody registered. Runtime detection uses stateful models and behavioural profiling, and each finding is analysed for impact and severity so teams work first on what affects the most assets or the business most.
Proactive Quality Detection
Proactive Quality Detection helps manufacturers find defects early by surfacing weak signals at asset, component and fleet level. That supports root cause analysis and cuts warranty and recall costs. Each issue gets a Compound Impact Score that weighs severity, predicted fleet scale and possible safety impact.
Runtime AI And API Security
Runtime AI and API Security is for organisations exposing APIs and deploying AI agents around their connected products. It discovers API endpoints, API consumers, MCP servers and agents, then monitors their context, behaviour and intent in production. When an agent or consumer misbehaves it can block or isolate it and revoke its tokens.
How It Works
The platform is cloud-based and cloud-agnostic, deployed in the customer’s own cloud for data sovereignty or as SaaS. The core platform is agentless and needs no software or hardware installed on the assets.
| Component | What it does |
|---|---|
| Data ingestion | Telematics, sensor data, API traffic and IT and OT events are collected and normalised. For API security, traffic arrives by mirroring from a gateway or load balancer, or through a lightweight agent. |
| Digital twins | Upstream keeps a live digital representation of each asset, including vehicles, components and IoT devices, and the detection products run against these twins rather than against raw events. |
Agentic AI Capabilities
Ocean AI
Ocean AI is the AI layer built into the platform. Analysts and SOC teams work with it through a conversational interface, and its agents classify, investigate and triage alerts and run playbooks, with humans kept in the loop.
MCP Server
Upstream’s MCP server connects the platform to enterprise tools and external sources, so Ocean AI and other clients can draw on data beyond Upstream itself.
AI Agents As Monitored Assets
AI agents that act on connected products are treated as assets in their own right: Runtime AI and API Security inventories them alongside MCP servers and APIs, and the same response controls apply when an agent’s behaviour drifts.
Company Background
| Founders | Yoav Levy (co-founder and CEO) and Yonatan Appel (co-founder and CTO). |
|---|---|
| Leadership | Roy Bachar (Chief Business Officer), Keren Cohen (CFO) and Boaz Hartal (Chief Data and Platform Officer). |
| Offices | Herzliya (Israel), Nashville, San Francisco, Boston, New York, Detroit, Denver, London, Gothenburg, Turin, Paris, Munich, Frankfurt, Tokyo and Singapore. |
| Research | The AutoThreat® team publishes an annual automotive and smart mobility cybersecurity report. |
| Recognition | Included in the GigaOm Radar for Cybersecurity XDR (2026). |
Note: This overview is compiled from Upstream Security’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.